0

Yesterday we received this email message through the contact form of our website from a russian server:

9th of April - SPOOF MESSAGE:

Name: John
Surname: Smith
EMail: pii-041570bf82880909f0aefee159d41349b9f2904e5bed6b48478e1a5473432277
Company: MyCompany
Phone: 1178322276
Message: I'm testing the contact form, please ignore.
IP Address: 95.84.220.109
Hostname: broadband-95-84-220-109.ip.moscow.rt.ru
Location: 55.7527,37.6172
Organization: AS42610 PJSC Rostelecom
City: Moscow
Region: Moscow
Country: RU
Postal: 109548

The strange part is that 30 days earlier one of our employees indeed sent this message to test the form was working properly:

13th of March - REAL MESSAGE:

Name: John
Surname: Smith
EMail: jsmith@mycompany.com
Company: MyCompany
Phone: 1178322276
Message: I'm testing the contact form, please ignore.
IP Address: 200.47.30.155
Hostname: line155.comsat.net.ar
Location: -27.4806,-58.8341
Organization: AS7908 BT LATAM Venezuela, S.A.
City: 
Region: Corrientes
Country: AR
Postal: 

As you see the spoof message has the exact name, surname, company, phone and text content of the real one. How could the spoof sender determine this information?

Our site is hosted at an external hosting provider, and we are using PHPMailer, an Office365 account to send the message, and http://ipinfo.io/ to get the sender information.

Thanks in advance!

  • There is insufficient data provided to give any serious answer. Your website host could have a security flaw, your user could have engaged in poor OpSec of his client machine, or any number of other possibilities. – Don Simon Apr 10 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.